Device and method for testing a sequence generated by a random number generator

ABSTRACT

Embodiments provide a device for testing a bit sequence generated by a Random Number Generator, wherein the device is configured to apply one or more statistical tests to the bit sequence, in response the detection of N bits generated by the Random number generator, each statistical test providing at least one sum value derived from the bits of the sequence, the testing device comprising: a comparator for comparing at least one test parameter related to each statistical test to one or more thresholds; a validation unit configured to determine if the bit sequence is valid depending on the comparison made by the comparator for each statistical test; wherein at least one of the test parameter and the at least one threshold is determined from N and from a target error probability.

TECHNICAL FIELD

The invention generally relates to a device and a method for testing asequence generated by a Random Number Generator.

BACKGROUND

Random Number Generators are used to generate a set of random numbers(in the form of bit streams) for use in a number of systems. Forexample, a Random Number Generator can be used in a cryptographic systemto generate random cryptographic keys which are used to transmit datasecurely.

Random number generators comprise Hardware Random Number Generators,also called True Random Number Generators (TNRG), which generate a setof numbers from a physical process, rather than a computer program(non-deterministic source), and Pseudorandom Number Generators whichgenerate numbers from a deterministic source such as a deterministicalgorithm.

TNRG can be based on microscopic phenomena that generate low-level,statistically random “noise” signals, such as thermal noise or a shotnoise, the photoelectric effect, involving a beam splitter, and otherquantum phenomena. A TNRG generally comprises a transducer whichconverts quantities or data derived from the physical phenomena into anelectrical signal, an amplifier, additional components configured toincrease the amplitude of the random fluctuations up to a measurablelevel, and an analog to digital converter configured to convert theoutput thus obtained into a digital number (for example a binary digit 0or 1). The TRNG then repeatedly samples the randomly varying signal toobtain a series of random numbers.

The quality of random numbers generation is paramount for implementationof cryptographic systems (for example for key generation, authenticationprotocols, padding, digital signature, encryption algorithms). In suchapplications, security closely depends on the quality of the generatedrandom numbers.

Indeed, many attacks target weaknesses in the implementation of thecryptographic system. Such weaknesses can result from the quality of thegenerated random numbers and be exploited by attackers to try to breakthe system.

Several testing methods and systems exist for testing the quality (inparticular the randomness) of generated random numbers, most of thembeing based on the statistical tests.

Such tests are applied to check whether a sequence of randomly acquirednumbers has two main statistical properties:

-   -   the generated values should be uniformly distributed and,    -   the generated values should be independent from previously        generated values.

In recognition of this, standardization entities like NIST and BSI hasestablished a statistical test suite given a binary sequence of 20000bits. The aim of this document is to provide a mathematicalinterpretation of the tests and to establish generalized mathematicalformulas given a sequence of N bits, an error probability and otherparameters.

There is currently a need to test the set of random number generated bythe TNRG as it may affect the performance of the system using suchrandom numbers such as the AIS31, FIPS140-1, NIST, and DIEHARD tests.

Standardization entities like NIST and BSI has established a statisticaltest suite given a binary sequence of a fixed number of bits (20000bits).

In existing approaches, the statistical tests are thus applied each timethe TRNG produces a sequence of 20000 bits, the test calculatingdifferent sums based on the sequence. Such sums are then compared topredefined and fixed threshold, and depending on the result of thecomparison it is decided whether to accept or reject the sequence. Thethresholds used to perform the comparison are predefined as a functionof a fixed error probability.

Existing testing methods and devices introduce incontrollable latency.Further, they cannot be adapted to address a target error probability.

There is accordingly a need for improved method and devices for testingthe sequence of bits generated by a Random Number Generator.

SUMMARY OF THE INVENTION

To address these and other problems, there is provided a device fortesting a bit sequence generated by a Random Number Generator, thedevice being configured to apply one or more statistical tests to thebit sequence, in response the detection of N bits generated by theRandom number generator, each statistical test providing at least onesum value derived from the bits of the sequence. The testing device maycomprise:

-   -   a comparator for comparing at least one test parameter related        to each statistical test to one or more thresholds;    -   a validation unit configured to determine if the bit sequence is        valid depending on the comparison made by the comparator for        each statistical test;

the at least one of the test parameter and the at least one threshold isdetermined from N and from a target error probability.

In some embodiments, the at least one or more statistical tests appliedto the sequence may comprise a set of statistical tests providing atleast one sum value derived from the bits of the sequence, whichprovides the at least one test parameter for each statistical test, thedevice further comprising:

-   -   a threshold determination unit for determining, for each        statistical test of the set of statistical test, a lower        threshold and a higher threshold from N and from the target        error probability in association with each sum value;

the comparator being configured to compare, for each statistical test,each sum value to the associated lower threshold and higher threshold.

In such embodiments, the comparator may be configured to output avalidation bit for a statistical test, if each sum value is strictlysuperior to the associated lower threshold and strictly inferior to thehigher threshold.

Further, the validation unit may be configured to reject the bitsequence if at least one sum value for a statistical test is inferior orequal to the associated lower threshold or superior or equal to thecorresponding higher threshold.

In one embodiment, the statistical tests may comprise the AIS MonobitTest which provides a sum value T₁, the corresponding lower threshold L₁and the higher threshold H₁ being equal to:

${L_{1} = {\frac{N}{2} - {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}}},{and}$${H_{1} = {\frac{N}{2} + {\sqrt{\frac{N}{2}} \times \;{{erfc}^{- 1}(\alpha)}}}},$

with α representing the target error probability.

In one embodiment, the statistical tests may comprise the AIS PokerTest, the testing device determining a sum value T₂. The correspondinglower threshold L₂ and the higher threshold H₂ are equal to:

${L_{2} = {\left( {{\chi_{({2^{M} - 1})}^{2}\left( {{0.3} \times \alpha} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}},{and}$${H_{2} = {\left( {{\chi_{({2^{M} - 1})}^{2}\left( {1 - {{0.7} \times \alpha}} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}},$

with M representing the length of the contiguous blocks in the bitsequence and a representing the error probability.

In an embodiment, the statistical tests may comprise the AIS runs Test,the testing device determining a sum value T_(3(N,k)) for each run oflength k, for the runs test, the lower threshold L_(3,k) and the higherthreshold H_(3,k) for each run of length k being equal to:

L _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α)

H _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α),

with α representing the target error probability and

$\mu_{N,k} = {\frac{N}{2^{k + 2}}.}$

In some embodiments, the at least one or more statistical tests appliedto the sequence comprise an additional set of statistical tests, thetesting device determining, for each statistical test, a test parameterdetermined from N and from the error probability.

In particular, the statistical tests may comprise the AIS Longest RunTest, the test parameter being a run length k, the length k beingdetermined according to the following equation:

${k = {- {\log_{2}\left( {1 - e^{\frac{\ln{(\alpha)}}{N}}} \right)}}},$

where a designates the long run probability. The comparator may thencompare the test parameter k to the run of maximal length.

In one embodiment, the bit sequence length N may be changed between oneor more clock cycles.

A new value for the error probability and the number N may be receivedat different times or simultaneously.

There is further provided a system implemented on at least oneintegrated circuits, the system comprising a device using a random bitsequence generated by a random number generator, wherein the devicefurther comprises a testing device according to any of the precedingembodiments, for testing each random bit sequence generated by therandom number generator before using it.

There is further provided a method for testing a bit sequence generatedby a Random Number Generator, wherein the method comprises applying oneor more statistical tests to the bit sequence, in response the detectionof N bits generated by the Random number generator, each statisticaltest providing at least one test parameter from the bits of thesequence, the testing method comprising comparing at least one testparameter related to each statistical test to one or more thresholds;determining if the bit sequence is valid depending on the comparisonperformed for each statistical test in the comparing step. At least oneof the test parameter and the at least one threshold is determined fromN and from a target error probability.

The invention accordingly enables control of the latency/debit of RandomNumber Generator implemented in a given system.

Embodiments of the invention thus provide a flexible and fullylatency-controllable RNG throughout all stages of operation.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate various embodiments of theinvention and, together with the general description of the inventiongiven above, and the detailed description of the embodiments givenbelow, serve to explain the embodiments of the invention:

FIG. 1 depicts a device for testing a random number sequence generatedby a Random Number Generator, according to some embodiments.

FIG. 2 illustrating the probability of a run used in a Longest Test,according to some embodiments.

FIG. 3 is a flowchart depicting a method of testing a random numbersequence generated by a Random Number Generator, according to someembodiments.

Additionally, the detailed description is supplemented with Exhibit E1.This Exhibit is placed apart for the purpose of clarifying the detaileddescription, and of enabling easier reference. It nevertheless forms anintegral part of the description of the present invention.

DETAILED DESCRIPTION

Embodiments of the present invention provide a device and a method fortesting the sequence of random numbers generated by a Hardware RandomNumber Generator such as a TRNG (True Random Number Generator). In thefollowing description, the Random Number Generator will be also referredto as a RNG.

Referring to FIG. 1 there is shown an exemplary operational environment100 of the testing device 10 comprising a cryptosystem 12 usingsequences of random numbers generated by a Hardware Random NumberGenerator 11 for generating keys, performing authentication, generatingsignatures, and/or performing encryption, etc.

The testing device 10 is configured to test the quality of the randomnumber sequences generated by the Random Number Generator 11 a set ofstatistical tests 103 comprising one or more statistical tests T₁, T₂, .. . , T_(p), with P being at least equal to one.

It should be noted that the invention is not limited to the use of thetesting device 10 in a cryptosystem 12 but may be used generally in anysystem or device using a sequence of random numbers generated by aHardware RNG 11. The system 100 and/or the system 12 can be implementedon one or more integrated circuits.

The following description of some embodiments will be made withreference to a cryptosystem 12 for illustration purpose only.

The statistical test Test_j may be configured to test the statisticalproperties that are required by the cryptosystem, including backward andforward unpredictability property of the Random Number Generator 11.

Exemplary statistical tests Tj include for example AIS, tests testingentropy increase per generated number, etc.

More specifically, the testing device 10 may be configured to receive,during operation of the system 100, a desired error probability α and afrequency number N defining a number of bits of a sequence generated bythe RNG 11. N may be inferior to the maximal number of bits M that theRNG 11 can generate. In particular, N can be adjusted during theoperation of the system depending on a number of criteria. Accordingly,N may be changed between one or more clock cycles. Advantageously, thevalue N may be different from a predefined fixed value and mayaccordingly take a value different from the value N′=20000conventionally used to activate the statistical tests. A new value forthe error probability α and the frequency number N may be received atdifferent times or simultaneously.

As used herein, the desired error probability (also referred to hereinas the “significance level” or “target error probability”) refers to theprobability of error of the test made on a sequence generated by the RNG11, that is the probability that the test made by the testing device ona given sequence generated by the RNG 11, using the set of statisticaltests 103, returns an erroneous result. The desired error probability αis thus defined as the probability of the test rejecting a sequencegenerated by the RNG 11, given that it was truly random.

The RNG 11 may be activated to generate a sequence of random numberscomprising a number of bits from an entropy source, using the currentvalue of the desired error probability r and the frequency number N foruse by the cryptosystem 12 (for example for key generation).

The testing device 10 may be configured to test a bit sequence generatedby a Random Number Generator 11, by applying one or more statisticaltests 103 to the bit sequence, in response the detection of N bitsgenerated by the Random number generator. Advantageously the number Nand the target probability may be varied depending on the application ofthe invention (N may be defined as small as possible if fast processingtime is needed or increased if the test is required to limit falsepositive as much as possible).

Each statistical test 103 provides at least one test parameter derivedfrom the bits of said sequence.

The testing device may comprise a comparator 102 configured to comparethe test parameter(s) related to each statistical test to one or morethresholds and a Random Number sequence validation unit 105 configuredto determine if the N-bit sequence is valid depending on the comparisonmade by the comparator 102 for the statistical tests.

The Random Number sequence validation unit 105 may be configured toreject or validate the N-Bit Random Number Sequence using the results ofthe statistical tests 103 applied to the sequence. In such embodiment,the comparator 102 may return the resulting values O_(j) to the RandomNumber sequence validation unit 105.

In one embodiment, the Random Number sequence validation unit 105 may beconfigured to validate the N-Bit Random Number Sequence only if, for allthe P statistical tests, condition (1) applied to each sum valueobtained by the execution of the statistical test is satisfied for theconsidered N-bit sequence (i.e. O_(j)=O_(j,2) for j=1 to K).

Each statistical test 103 may be a statistical test for testingrandomness in the N-bits binary sequence generated by the RNG 11.

Advantageously, at least one of the test parameter and the threshold(s)is determined from N and from a target error probability.

The testing device 10 thus executes a set of P statistical tests (Pbeing at least equal to 1), in response to the generation of a N-bitrandom number sequence (that is in response to the detection of a numberof bit equal to N in the random number sequence), as the random bit arereceived from the Random Number Generator 11. The set of P statisticaltests may be stored in a storage unit 103.

In some embodiments, the set of statistical tests 103 comprise a set ofstatistical tests, which each are used to determine one or more sumvalues (several values if the test comprises several runs) derived fromthe N bits of the random number sequence and the error probability α.

The testing device 10 may further comprise a threshold determinationunit 101 configured to determine at least one threshold pair comprisinga lower threshold L_(j) and a higher threshold H_(j), for each testTest_j, the lower threshold L_(j) and the higher threshold H_(j)depending on the parameter N and on a significant level parameter α.

The testing device 10 may be configured to check, for each statisticaltest Test_j, whether each value (sum result) returned by the consideredstatistical test Test_j, meets a condition related to a correspondingthreshold pair (lower threshold L_(j) and higher threshold H_(j)) thusdetermined.

In such embodiments, the comparator 105 may be configured to compareeach sum result returned by a statistical test Test_j with the lowerthreshold L_(j) and to the higher threshold H_(j) of the associatedpair.

In one embodiment, the comparator 105 of the testing device may beconfigured to determine whether each value Tj (sum result) returned by astatistical test Test_j is strictly higher than the lower threshold Ljand strictly inferior to the higher threshold Hj of the associatedthreshold pair. The condition that is checked for the value Tj based onthe corresponding threshold pair (lower threshold L_(j) and higherthreshold H_(j)) may be expressed as:

L _(j) <T _(j) <H _(j)  (1)

It should be noted that in some embodiments, a plurality of sum valuesmay be determined for each statistical test (for example if the testcomprises several runs), and for each value a corresponding thresholdpair is determined, condition (1) being tested for each sum value andeach corresponding threshold pair.

The comparator 105 may return a resulting value O_(j) for each testTest_j applied to the N-Bit sequence, set to the first value Oj_(,l) ifthe test condition of Equation (1) is not satisfied or a second valueOj_(,2) if the test condition of Equation (1) is satisfied.

To facilitate understanding of some embodiments of the invention, thefollowing definitions are provided:

As used herein, a ‘Null hypothesis H₀’ refers the statement that aprovided sequence is truly random.

A ‘test statistic S’ refers to a numerical summary that reduces theobserved data to one value.

A ‘p-value’ refers to the probability that, when H₀ is true, thestatistical test would be the same as or of greater magnitude than theactual observed results.

A ‘significance level’ a (also referred to herein as the “errorprobability”) refers to the probability of rejecting H₀, given that itwere true.

Given such definitions, a statistical test is conducted as follows:

-   -   If p-value ≥α then H₀ is accepted;    -   If p-value <α then H₀ is rejected.

The p-value may be computed given the statistical model of the teststatistic S.

Such model may apply to all statistical tests used to link empiricaldata of a real-world RNG to a stochastic model.

The set of statistical test 103 may comprise for example one or moretests of the AIS31 Tests Suite which comprises:

-   -   A Monobit Test;    -   A Poker Test;    -   A Runs Test;    -   A Longest Run Test.

The following description of some embodiments will be made withreference to one or more tests of the AIS31 suite for illustrationpurpose only.

In the following description a random number sequence comprising bitsb_(i) and having a length N is considered.

In one embodiment, the set of statistical test 103 may comprise theMonobit Test. The Monobit Test is configured to determine the proportionof the number of ones and zeros in a given bit sequence. For a randomsequence, it is expected that the average number of ones (andconsequently zeros) in the sequence is ½.

According to one embodiment, the AIS31 Monobit test examines a sequenceof N bits by calculating the sum T₁ as follows:

$T_{1} = {\sum\limits_{i = 1}^{N}b_{i}}$

According to one embodiment of the invention, a set of statisticalparameters {H₀, S_(N), α} may be defined to run the monobit test:

-   -   H₀: The hypothesis is made that the generated bit sequence is        random;    -   A parameter S_(N) is defined such that:

S _(N)=Σ_(i=1) ^(N)(2×b _(i)−1)  (2)

-   -   The error probability α is set to:

α=9.6×10⁻⁷  (3)

-   -   the observation to be tested:

$\begin{matrix}{S_{obs} = \frac{s_{N}}{\sqrt{2N}}} & (4)\end{matrix}$

Considering

$S_{obs} = \frac{s_{N}}{\sqrt{2N}}$

(observation to be tested), the reference distribution of suchobservation is half normal for a large value of N. As used herein, ahalf normal distribution refers to a normal distribution with mean 0(zero). A definition of a normal distribution is provided in ExhibitE1.1. If the sequence is random, then the plus and minus ones will tendto cancel each other out so that the test statistic is about 0.

The p-value (probability that, when H₀ is true, the statistical testwould be the same as or of greater magnitude than the actual observedresults) is the given by:

pvalue=erfc(S _(obs))  (5)

In Equation (1), erfc(z) represents the complementary Gauss errorfunction:

$\begin{matrix}{{{erfc}\;(z)} = {\frac{2}{\sqrt{\pi}}{\int_{z}^{+ \infty}{e^{- u^{2}}du}}}} & (6)\end{matrix}$

For a random variable X that is half-normally distributed, erfc(x) isthe probability of X falling out of the range [−x,x].

According to the testing method, H₀ is accepted if:

pvalue ≥α  (7)

According to Equations (4) and (5), equation (7) can be rewritten:

$\begin{matrix}{{{erfc}\left( {\frac{s_{N}}{\sqrt{2N}}} \right)} \geq \alpha} & (8)\end{matrix}$

As erfc⁻¹ is a decreasing function in:

$\begin{matrix}{{{\frac{s_{N}}{\sqrt{2N}}} \leq {{erfc}^{- 1}(\alpha)}};} & (9) \\{{{S_{N}} \leq {\sqrt{2N} \times {{erfc}^{- 1}(\alpha)}}};} & (10)\end{matrix}$

According to Equation (2):

|S _(N)|=Σ_(i=1) ^(N)(2×b _(i)−1)=2×Σ_(i=1) ^(N) b _(i)−Σ_(i=1)^(N)1=2×T ₁ −N  (11)

Equation (10) can be then rewritten as:

|2×T ₁ −N|≤√{square root over (2N)}×erfc⁻¹(α)  (12)

By dividing equation (12) by two, the following inequality is obtained:

$\begin{matrix}{{{T_{1} - \frac{N}{2}}} \leq {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}} & (13)\end{matrix}$

Given N, the length of the sequence:

$\begin{matrix}{{\frac{N}{2} - {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}} \leq T_{1} \leq {\frac{N}{2} + {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}}} & (14)\end{matrix}$

Accordingly, the condition of Equation (1) for the Monobit Test can berewritten as:

L ₁ <T ₁ <H ₁

With:

$\begin{matrix}{{L_{1} = {\frac{N}{2} - {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}}},\mspace{14mu}{and}} & (15) \\{H_{1} = {\frac{N}{2} + {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}}}} & (16)\end{matrix}$

The testing device 10 may be then configured to execute the Monobit teston the random number sequence of N bits generated by the RNG 11 and testif the resulting sum T₁ is comprised between the lower threshold L₁ andthe higher H₁, which both depend on N and on the error probability α.

The comparator 105 will return a resulting value O₁ for the Monobit testapplied to the N-Bit sequence set to the first value O_(1,1) if the testcondition of Equation (1) is not satisfied or a second value O_(1,2) ifthe test condition of Equation (1) is satisfied.

It should be noted that for N=20000 and α=9.6×10⁻⁷, the condition (1)for the Monobit test is:

-   -   9653.54133637<T₁<10346.4586636

In contrast, in a conventional approach, the AIS31 Monobit test examinesa sequence of 20000 bits by calculating the sum T₁ as T₁=Σ_(i=1) ²⁰⁰⁰⁰b_(i), and considering a fixed lower threshold and a fixed higherthreshold (such thresholds being defined statically independently of theselected value N and of the error probability α).

Conventionally, the test fails if T₁ falls outside the range defined bythe fixed thresholds.

In some embodiments, the set of statistical test 103 may comprise thePoker Test.

In one embodiment, to estimate the condition (1) for the Poker Test, thefollowing statistical parameters used to run the Poker test are defined:

-   -   H₀: The hypothesis is made that the generated bit sequence is        random;    -   The test statistic S_(N,M) defined as:

$\begin{matrix}{S_{N,M} = {{\frac{2^{M}}{\left\lfloor \frac{N}{M} \right\rfloor} \times \left( {\sum\limits_{i = 0}^{{2M} - 1}\;{f(i)}^{2}} \right)} - \left\lfloor \frac{N}{M} \right\rfloor}} & (17)\end{matrix}$

In Equation (17), N represents the length of the sequence, M representsthe length of the contiguous blocks and ƒ(i) denotes the numbers ofoccurrences of each of the possible M bit values. Given a real number x,└x┘ denotes the integer part of x.

Further, for the Poker Test, the error probability α is defined asα=1.014×10⁻⁶.

The Poker test consists in determining the proportion of ones withineach M bit block. The frequency of ones in every M bit block should be

x

as would be expected for a random sequence. The numbers of occurrencesƒ(i) are normally distributed, so S_(N,M) follows a “chi square” (χ²)distribution of 2^(M)−1 degrees of freedom. A definition of a chi squaredistribution is provided in Exhibit E1.2.

To determine whether there is a significant difference between theexpected frequencies and the observed frequencies, the observation to betested χ_(obs) ²(=S_(N,M)) can be limited within two critical values ofχ₍₂ _(M) ⁻¹⁾ of 2^(M)−1 degrees of freedom, given an error probabilityα. In AIS31, the error probability may be chosen equal to 30%×α and to70%×α. Accordingly, the inferior boundary is χ₍₂ _(M) ⁻¹⁾(0.3×α) and thesuperior boundary is χ₍₂ _(M) ⁻¹⁾(1−0.7×α), which leads to the generalformula of T₂, given N and M:

$\begin{matrix}{{\left( {{X_{({2^{M} - 1})}^{2}\left( {0.3 \times \alpha} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}} \leq {T_{2}\left( {N,M} \right)} \leq {\left( {{X_{({2^{M} - 1})}^{2}\left( {1 - {0.7 \times \alpha}} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}} & (18)\end{matrix}$

The “chi square” χ² distribution has only one parameter which determinesits degree of freedom. This means that the boundaries are the samewhatever N is, unless M changes.

Accordingly, the condition of Equation (1) for the Monobit Test can berewritten as:

L ₂ <T ₂ <H ₂

With the lower threshold L₂ and the higher threshold H₂ being givendefined as follow:

$\begin{matrix}{{L_{2} = {\left( {{X_{({2^{M} - 1})}^{2}\left( {0.3 \times \alpha} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}},\mspace{14mu}{and}} & (19) \\{H_{2} = {\left( {{X_{({2^{M} - 1})}^{2}\left( {1 - {0.7 \times \alpha}} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}} & (20)\end{matrix}$

As shown by Equation (19) and (20), the lower threshold L₂ and thehigher threshold H₂ also depend on N and on the error probability α. Inthe case of the Poker test, the lower threshold L₂ and the higherthreshold H₂ further depend on M (M represents the length of thecontiguous blocks).

The testing device 10 may be accordingly configured to execute the Pokertest on the random number sequence of N bits generated by the RNG 11 andtest if the resulting sum T₂ is comprised between the lower threshold L₂and the higher H₂, which both depend on N and on the error probabilityα.

The comparator 105 will return a resulting value O₁ for the Poker testapplied to the N-Bit sequence set to the first value O_(1,1) if the testcondition of Equation (1) is not satisfied or a second value O_(1,2) ifthe test condition of Equation (1) is satisfied.

For example, according to the testing device and method applied to thePoker test, for M=4 and α=1.014×10⁻⁶:

χ₁₅ ²(0.3×1.014×10⁻⁶)=1.02613902048

χ₁₅ ²(1−0.7×1.014×10⁻⁶)=57.3711974356

And:

1 562 820,6684439≤T ₂(N,M)≤1 580 428,499198625

In contrast, in a conventional approach, the Poker test:

-   -   starts by dividing the sequence of N=20000 bits into a fixed        number of 5000 contiguous 4 bit segments, then counts and store        the number of occurrences of each of the possible 4 bit values.    -   Compute the T₂ sum:

$T_{2} = {\sum\limits_{i = 0}^{15}\;{f(i)}^{2}}$

-   -   Check if the sum T₂ is strictly comprised between a fixed lower        threshold and a fixed higher threshold, both defined statically        independently of the selected value N and of the target error        probability α.

Conventionally, the test fails if T₂ falls outside the range defined bythe fixed thresholds.

In some embodiments, the set of statistical test 103 may comprise theRuns Test.

The purpose of the Runs test is to determine whether ones and zeros arenot changing too fast (0101010101) or too slow (0000011111).

A run is defined as a maximal sequence of consecutive bits of either allones or all zeros.

The incidences of runs (for both consecutive zeros and consecutive ones)of all lengths (≥1) in the sample stream can be counted and stored. TheRuns test is passed if the number of runs that occur (of lengths 1through 6) is each within the corresponding interval specified below.This holds for both the zeros and ones; that is, all 12 counts must liein the specified interval. For the purpose of this test, runs of greaterthan 6 are considered to be of length 6.

T₃(N,k) denotes a run of length k of either the bit 0 or 1, occurring ina sequence of length N.

To estimate the condition according to formula (1) for the runs Test,the following statistical parameters used to apply the Runs test aredefined:

-   -   H₀: The hypothesis is made that the generated bit sequence is        random;    -   S which designates the number of runs of length k denoted        T₃(N, k) where n the sequence length; and    -   A error probability α=k×10⁻⁶ where k∈{3.25; 1.33; 0.85; 0.40;        0.10}.

Assuming that the sequence bits are identically distributed, the teststatistic T₃(n, k) for the Runs Test is considered normally distributed.The mean of such distribution is

${\mu_{N,k} = \frac{N}{2^{k + 2}}},$

because the probability of each run of zeros or ones is the same.Accordingly, in

$\frac{N}{2},$

there are k-runs or zeros or ones and each bit has a probability of ½ tooccur. The mean value expected is thus

$\frac{\frac{N}{2}}{2^{k + 1}} = {\frac{N}{2^{k + 2}}.}$

The sum of all the k-runs if the experience is done an infinite numberof times is

$\frac{N}{2}.$

As a result Σ_(k=0) ^(+∞) μ_(N,k) can be written:

$\begin{matrix}{{\sum\limits_{k = 0}^{+ \infty}\;\frac{N}{2^{k + 2}}} = {{\frac{N}{4}{\sum\limits_{k = 0}^{+ \infty}\left( \frac{1}{2} \right)^{k}}} = {{\frac{N}{4} \times \frac{1}{1 - \frac{1}{2}}} = \frac{N}{2}}}} & (21)\end{matrix}$

Considering the observation

${S_{obs} = {\frac{{T_{3}\left( {N,k} \right)} - \mu_{N,k}}{\sqrt{\mu_{N,k}}}}},$

the p-value is:

$\begin{matrix}{{erfc}\left( {\frac{{T_{3}\left( {N,k} \right)} - \mu_{N,k}}{\sqrt{\mu_{N,k}}}} \right)} & (22)\end{matrix}$

The quantity of Equation (22) may be then compared to the errorprobability α. The Runs test passes if:

p-value≥α  (23)

Condition (23) can be rewritten, according to Equation (22):

$\begin{matrix}{{{erfc}\left( {\frac{{T_{3}\left( {N,k} \right)} - \mu_{N,k}}{\sqrt{2 \times \mu_{N,k}}}} \right)} \geq \alpha} & (24)\end{matrix}$

Equation (23) can be further formulated as follows:

|T ₃(N,k)−μ_(N,k)|≤√{square root over (2×μ_(N,k))}×erfc⁻¹(α)  (25)

μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α)≤T_(3(N,k))≤μ_(N,k)+√{square root over (2×μ_(N,k))}×erfc⁻¹(α)  (26)

Accordingly, the condition of Equation (1) for the Run Test for each runk can be rewritten as:

L _(3,k) <T _(3(N,k)) <H _(3,k)  (27)

With the lower threshold L_(3,k) and the higher threshold H_(3,k) beinggiven defined as follows:

L _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α)  (28)

H _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α),  (29)

As shown by Equation (28) and (29), the lower threshold L_(3,k) and thehigher threshold H_(3,k) also depend on N and on the error probability α

$\left( {{as}\mspace{14mu}{\mu_{N,k} = \frac{N}{2^{k + 2}}}} \right).$

The testing device 10 may be accordingly configured to execute the Runstest on the random number sequence of N bits generated by the RNG 11 andtest if the resulting sum T_(3(N,k)) for each run of length k iscomprised between the lower threshold L_(3,k) and the higher H_(3,k),which both depend on N and on the error probability α. The comparator105 will return a resulting value O₁ for the Runs test applied to theN-Bit sequence set to the first value O_(1,1) if the test condition ofEquation (1) is not satisfied for at least one run of length k or asecond value O_(1,2) if the test condition of Equation (1) is satisfiedfor each of the considered runs of length k.

For example, for N=20000, k∈[1, 2, 3, 4, 5, 6] and α=K×10⁻⁶ wherek∈{3.25; 1.33; 0.85; 0.40; 0.10}, the following results indicated inTable 1 are obtained:

TABLE 1 Length of Run Required Interval 1 2267.04399878-2732.45600122 21078.99101268-1420.88398732 3 501.911931832-748.088068168 4222.906024885-402.125225115 5  89.678247301-222.853002699 6+ 89.678247301-222.853002699

In contrast, in a conventional approach, a run is defined as a maximalsequence of consecutive bits of either all ones or all zeros, which ispart of the 20,000 bit sample stream, the interval being given by thefollowing Table 2:

TABLE 2 Length of Run Required Interval 1 2267-2733 2 1079-1421 3502-748 4 223-402 5  90-223 6+  90-223

In some embodiments, the statistical tests 103 may include one or moreadditional statistical tests providing a sum value T_(L), but instead oftesting the sum value T_(L), the testing device 10 may be configured totest the N-bit sequence by comparing a test parameter determined fromthe frequency number N and from the error probability α to a threshold.

For example, the set of statistical test 103 may comprise the LongestRun Test.

In a conventional approach, on a sample of 20000 bits, the Longest RunTest is passed if there are NO long runs.

According to an embodiment of the invention, a longest run test may beused to test a bit sequence by determining the length k of a runcorresponding to the target error probability α which correspond in thecase of the longest run test to the long run probability P_(N)(k), andthen comparing the value k to a threshold. The test is passed if theinteger part of the determined value of k is inferior to the run oflongest length Long_run_max (└k┘<Long_run_max). Otherwise the testfails.

More specifically, the index k may be determined based on a long runprobability P_(N)(k), representing the probability of a run (zeros orones) of length longer than or equal to k, appearing in a sequence of Nbits is considered.

P_(N)(k) may be expressed by the addition of two mutually exclusiveevent probabilities. One of the event probability represents theprobability that the run longer than k appears in N−1 bits and the otherevent probability represents the probability that no run longer than kappears in N−1 bits but appears in right most k bits of N, as depictedin FIG. 2. This means that:

$\begin{matrix}{{P_{N}(k)} = {{P_{N - 1}(k)} + {\left( {1 - {P_{N - 1}(k)}} \right) \times \frac{1}{2^{k}}}}} & (30) \\{{P_{N}(k)} = {{\left( {1 - \frac{1}{2^{k}}} \right) \times {P_{N - 1}(k)}} + \frac{1}{2^{k}}}} & (31)\end{matrix}$

Equations (30) and (31) lead to the general expression given k and N:

$\begin{matrix}{{P_{N}(k)} = \left\{ \begin{matrix}{{0\mspace{14mu}{if}\mspace{20mu} N} \leq {k - 1}} \\{{\frac{1}{2^{k - 1}}\mspace{14mu}{if}\mspace{14mu} k} = N} \\{{{\left( {1 - \frac{1}{2^{k}}} \right) \times {P_{N - 1}(k)}} + {\frac{1}{2^{k}}\mspace{14mu}{if}{\mspace{11mu}\ }N}} \geq {k + 1}}\end{matrix} \right.} & (32)\end{matrix}$

This correspond to an arithmetic-geometric progression of the type:

U _(N) =α×U _(N-1) +b  (33)

Hence:

U _(N) =a ^(N)×(U ₀ −r)+r  (34)

${{In}\mspace{14mu}{Equation}\mspace{11mu}(34)},{= {\frac{b}{1 - a}.}}$

Accordingly:

$\begin{matrix}{{P_{N}(k)} = {{\left( {1 - \frac{1}{2^{k}}} \right)^{N} \times \left( {U_{0} - r} \right)} + r}} & (35)\end{matrix}$

In Equation (35), U₀=0 and r=1.

Equation (35) can be thus rewritten as:

$\begin{matrix}{{P_{N}(k)} = {1 - \left( {1 - \frac{1}{2^{k}}} \right)^{N}}} & (36)\end{matrix}$

In Equation (36), k can be accordingly found as follows:

$\begin{matrix}{{\ln\left( {P_{N}(k)} \right)} = {N \times {\ln\left( {1 - \frac{1}{2^{k}}} \right)}}} & (36.1) \\{e^{\frac{\ln{({P_{N}{(k)}})}}{N}} = {1 - \frac{1}{2^{k}}}} & (36.2) \\{{\ln\left( {1 - e^{\frac{\ln{({P_{N}{(k)}})}}{N}}} \right)} = {{- k} \times {\ln(2)}}} & (36.3) \\{k = {- {\log_{2}\left( {1 - e^{\frac{\ln{({P_{N}{(k)}})}}{N}}} \right)}}} & (36.4)\end{matrix}$

As P_(N)(k)=α, equation 36.4 may be rewritten as a function of N and α:

$\begin{matrix}{k = {- {\log_{2}\left( {1 - e^{\frac{\ln{(\alpha)}}{N}}} \right)}}} & (37)\end{matrix}$

For example, for N=2000 and P_(N)(k)=10⁻⁶, └k┘=34

The table below provides examples of test parameters calculated for theMonobit Test (T1), the Poker Test (T2), the Runs Test, and the Longestrun Test, according to the preceding equations which provides thelower/higher thresholds Li and Hi as a function of N and α (for T1, T2,T3) or the longest run parameter k as a function of a for N∈{5000,10000, 20000, 40000}, the value N=20000 being the fixed valueconventionally used for testing a bit sequence generated by the RNG 11(as defined by the standard NIST FIPS 140-2 and BSI AIS 31). In theexemplary table below, a given value of a is chosen for illustrativepurpose, although a can be varied:

TABLE 3 Test N = 5000 N = 10;000 N = 20;000 N = 40;000 T1 [2327, 2673][4755, 5245] [9654, 10;346] [19;510, 20;489] T2 [1.03, 57.37] [1.03,57.37] [1.03, 57.37] [1.03, 57.37] T3 Run of length 1: Run of length 1:Run of length 1: Run of length 1: [508, 741] [1085, 1414] [2267, 2733][4671, 5329] Run of length 2: Run of length 2: Run of length 2: Run oflength 2: [227, 398] [504, 746] [1079, 1421] [2258, 2742] Run of length3: Run of length 3: Run of length 3: Run of length 3: [95, 218] [225,400] [502, 748] [1076, 1424] Run of length 4: Run of length 4: Run oflength 4: Run of length 4: [33, 123] [93, 220] [223, 402] [498, 752] Runof length 5: Run of length 5: Run of length 5: Run of length 5: [6, 72][31, 125] [90, 223] [218, 407] Run of length 6+: Run of length 6+: Runof length 6+: Run of length 6+: [6, 72] [31, 125] [90, 223] [218, 407]T4 32 33 34 35

FIG. 3 is a flowchart of the method of testing a random bit sequencegenerated by a RNG 11, using a set of tests providing a sum test Ti(such as T1, T2 and T3) for which the condition (1) is checked, thecondition being defined by a lower and higher thresholds Li and Hi,which both depend on N and a, according to some embodiments.

In step 300, the error probability and the bit sequence length N arereceived. In step 302, generation of a random number sequence by the RNG11 is detected. In step 304, it is detected if N Bits have beengenerated by the RNG 11. If so, each of the P statistical tests 103 areapplied to the k-bit random number sequence received from the RNG 11 instep 306. Otherwise, the process returns to step 302. The execution ofeach statistical test provides at least one sum Ti. In the case of aruns test, each considered run k provides a sum T_(i,k).

In step 310, for each statistical test sum T₁ (or T_(i,k) for each run kof the runs test) obtained for a statistical test (block 308), a lowerthreshold L_(i) (or L_(i,k) for each run k of the runs test) and ahigher threshold H_(i) (or H_(i,k) for each run k of the runs test) aredetermined in association with the statistical test sum, the lowerthreshold and the higher threshold depending on N and on the errorprobability α.

In step 312, condition (1) is tested for each statistic test sum T_(i)(or T_(i,k) for each run k of the runs test) provided by eachstatistical test, using the associated lower threshold L_(i) (orL_(i,k)) and the associated higher threshold H_(i) (or H_(i,k)).

In step 314, if at least one statistical test does not satisfy condition1 (block 312), the random bit sequence may be rejected. Otherwise, steps310 and 312 are repeated for the other statistical tests, in not allstatistical test have been processed (step 313). In step 316, the randombit sequence is validated and the N-random bits may be delivered to thetarget system 12 if all the statistical test sums meet condition 1.

Exhibit E1.3 provides a testing method for testing a bit sequencegenerated by a RNG, as random bits arrive, in pseudo-code format,according to one embodiment, using the statistical tests:

-   -   Monbit Test (T1);    -   Poker Test (T2);    -   Runs Test (T3);    -   Longest Run test (T4).

The testing method of Exhibit E.1.3 has an optimized latency and isparticularly adapted to testing a N-bit sequence in a testing device 10embedded in a chip.

Embodiments of the invention accordingly enable a dynamic selection ofthe number N of raw bits to test given the targeted debit/latency. Theyalso provide a dynamic error probability r given the targetedapplication and fully controllable latency throughout all stages (incontrast to the prior art which, by waiting for a fixed number of rawbits, generate uncontrollable latency).

The embodiments of the invention apply to both embedded statisticaltests (the tests are performed within the chip of the system or deviceusing the random number sequence) and online statistical tests.

In some application requiring fast processing, the value of N can bechosen to be smaller than 20000 so that the overall time needed to texta bit sequence. In contrast, for applications requiring that thegenerated random number be evaluated more strictly, in order to reducethe number of false positive detections, the sequence size N can beincreased.

The embodiments of the invention thus enable a flexible adjustment of Nin accordance with the needs of the application.

The testing device according to the embodiments of the invention may beused in various applications such as:

-   -   simulation applications which simulate and model complex        phenomena (e.g. in Monte Carlo integration used in finance and        in engineering fields);    -   in random sampling applications which select random samples from        larger data sets;    -   in cryptographic applications such as authentication, signing,        encryption, digital signature generation, encryption key        generation systems, or internet encryption protocols        applications;    -   in chip manufacturing and seeding of device-specific keys, e.g.        for Near Field Communication or device IDs;    -   In machine learning and statistical learning applications (true        random number generators may be used to obtain samples from        random distributions).

Exemplary target systems 12 include cryptographic systems that implementcryptographic functions based on one or more cryptographic keys toensure data and/or signals security, authentication, protection, andprivacy such as:

-   -   smart cards, devices that store keys such as wallets, smart        cards readers such as Automated Teller Machines (ATM) used for        example in financial applications;    -   digital electronic devices such as RFID tags;    -   embedded secure elements;    -   computers (e.g. desktop computers and laptops), tablets;    -   routers, switches, printers;    -   mobile phones such as smart-phones, base stations, relay        stations, satellites;    -   Internet of Thing (IoT) devices, robots, drones; and    -   recorders, multimedia players, mobile storage devices (e.g.        memory cards and hard discs) where logon access monitored by        cryptographic mechanisms, etc.

In certain alternative embodiments, the functions, acts, and/oroperations specified in the flow charts, sequence diagrams, and/or blockdiagrams may be re-ordered, processed serially, and/or processedconcurrently consistent with embodiments of the invention. Moreover, anyof the flow charts, sequence diagrams, and/or block diagrams may includemore or fewer blocks than those illustrated consistent with embodimentsof the invention.

In particular, it should be noted that the statistical tests 103 may betested in any order, sequentially or in parallel.

While all of the invention has been illustrated by a description ofvarious embodiments and while these embodiments have been described inconsiderable detail, it is not the intention of the applicant torestrict or in any way limit the scope of the appended claims to suchdetail. Additional advantages and modifications will readily appear tothose skilled in the art. The invention in its broader aspects istherefore not limited to the specific details, representative apparatusand method, and illustrative examples shown and described. Inparticular, it should be noted that the invention is not limited tostatistical test of the AIS31 test set and may use other types ofstatistical tests used to test sequences generated by a RNG 11, such asfor example:

-   -   other tests from the AIS31 set including for instance the        auto-correlation test (test 5), the uniform distribution test        (test 6), the homogeneity test or the comparative test for        multinomial distributions (test 8), the entropy estimation test        (test 8).    -   tests from the NIST test suite, according for example to the        NIST SP800-22 test suite, such as for example the Serial test,        the Frequency (Monobit) test, etc.

Exhibit E1

Definitions

E1.1. Normal Distribution

A (continuous) random variable X has a normal distribution with mean μand variance σ² if its probability density function is:

${\left. {{f(x)} = {\frac{1}{\sigma\sqrt{2\pi}} \times e^{- \frac{{({x - \mu})}^{2}}{2\sigma^{2}}}{\forall{x \in}}}} \right\rbrack - \infty},{+ {\infty\lbrack}}$

The density function of a continuous random variable X satisfies:

-   -   ƒ(x)≥0 for all x∈]−∞,+∞[    -   ∫_(−∞) ^(+∞)ƒ(x)dx=1    -   For all a, b ∈]−∞, +∞[, P(a<X<b)=∫_(a) ^(b) ƒ(x)dx

E1.2 The “Chi Square” χ² Distribution

The χ² distribution may be used to compare the goodness-of-fit of theobserved frequencies of events to their expected frequencies under thehypothesized distribution. The χ² distribution with k degrees of freedomarises when the squares of k independent random variables havingstandard normal distributions are summed.

Let k≥1 be an integer. A continuous random variable X has a χ²distribution of k degrees of freedom if its density function is:

${f(x)} = \left\{ \begin{matrix}{{\frac{1}{{\Gamma\left( \frac{k}{2} \right)}2^{\frac{k}{2}}}x^{\frac{k}{2} - 1}e^{- \frac{x}{2}}},} & {0 \leq x \leq \infty} \\{0,} & {x < 0}\end{matrix} \right.$

where Γ(x) is the gamma function defined for t>0 as:

${g(t)} = {\int\limits_{0}^{\infty}{x^{t - 1}e^{- x}dx}}$

E.1.3: Testing Method Algorithm 1: Online computation of T1, T2, T3 andT4 tests  input : A bit sequence (b_(i))_(1≤i≤N) to be tested  output:Four Boolean numbers, which indicated which test is passed/failed//Tests initialization  // Statistics  1 sum ← 0 // For the T1 test  2f[16] ← {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} // For the T2test  3 run[6][2] ← {{0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}} // For theT3 test  4 long_run_max ← 0 // For the T4 test   // Ancillaryaccumulators  5 prev_b ← ⊥ (that is neither 0 nor 1) // Detecting runends  6 poker_current ← 0 // Poker test bin  7 long_run_current ← 0 //Length of current run // Accumulators updated  8 for i ∈ {1, . . . , N}do  9 | sum+ = b_(i) 10 | i₄ ← i mod 4 11 | poker_current+ = b_(i) ×2^(i) ⁴ 12 | if i₄ = 0 then 13 | | f[poker_current]+ = 1 14 | └poker_current ← 0 15 | if b_(i) = prev_b then 16 | | long_run_current+ =1 17 | else // Current run ends 18 | | if long_run_current < 6 then 19 || | run[prev_b][long_run_current − 1]+ = 1 20 | | else 21 | | └run[prev_b][6]+ = 1 22 | | if long_run_max < long_run_current then 23 || └ long_run_max ← long_run_current 24 | └ long_run_current ← 0 25 └prev_b ← b_(i) // Finalization 26 return  ${T\; 1\text{:}\mspace{14mu}{{{sum} - \frac{N}{2}}}} \leq {\sqrt{\frac{N}{2}} \times {{erfc}^{- 1}(\alpha)}\mspace{14mu}\left( {{recall}\mspace{14mu}{{Eqn}.\mspace{14mu}(1)}} \right)}$  $\quad\;\begin{matrix}{{T\; 2}:\mspace{14mu}{{\chi_{2^{M} - 1}^{2}\left( {0.3 \times \alpha} \right)} \leq {{\frac{2^{M}}{N/M}\left( {\sum_{i = 0}^{2^{M} - 1}\left( {f\lbrack i\rbrack}^{2} \right)} \right)} - \frac{N}{M}} \leq {\chi_{2^{M} - 1}^{2}\left( {1 - {0.7 \times \alpha}} \right)}}} \\\left( {{recall}\mspace{14mu}{{Eqn}.\mspace{14mu}(2)}} \right)\end{matrix}$   $\quad\begin{matrix}{{{T\; 3}:\mspace{14mu}{{{{{{run}\lbrack b\rbrack}\lbrack m\rbrack} - \frac{N}{2^{k + 2}}}} \leq {\sqrt{\frac{N}{2^{k} + 1}} \times {{erfc}^{- 1}(\alpha)}}}},{{{for}\mspace{14mu}{all}\mspace{14mu} b} \in {\left\{ {0,1} \right\}\mspace{14mu}{and}}}} \\{m \in {\left\{ {0,1,2,3,4,5} \right\}\mspace{14mu}\left( {{recall}\mspace{14mu}{{Eqn}.\mspace{14mu}(3)}} \right)}}\end{matrix}$  T4: long_run_max > −log₂(1 − (1 − α)^(1/N)). (recall Eqn.(4))

1. A device for testing a bit sequence generated by a Random NumberGenerator, wherein the device is configured to apply one or morestatistical tests to the bit sequence, in response the detection of Nbits generated by the Random number generator, each statistical testproviding at least one sum value derived from the bits of said sequence,the testing device comprising: a comparator for comparing at least onetest parameter related to each statistical test to one or morethresholds; a validation unit configured to determine if said bitsequence is valid depending on the comparison made by the comparator foreach statistical test; wherein at least one of said test parameter andsaid at least one threshold is determined from N and from a target errorprobability.
 2. The device of claim 1, wherein said at least one or morestatistical tests applied to the sequence comprise a set of statisticaltests providing at least one sum value derived from the bits of saidsequence, which provides said at least one test parameter for eachstatistical test, the device further comprising: a thresholddetermination unit for determining, for each statistical test of saidset of statistical test, a lower threshold and a higher threshold from Nand from the target error probability in association with each sumvalue; wherein the comparator is configured to compare, for eachstatistical test, each sum value to the associated lower threshold andhigher threshold.
 3. The device of claim 2, wherein the comparator isconfigured to output a validation bit for a statistical test, if eachsum value is strictly superior to the associated lower threshold andstrictly inferior to the higher threshold.
 4. The device of claim 3,wherein the validation unit is configured to reject the bit sequence ifat least one sum value for a statistical test is inferior or equal tothe associated lower threshold or superior or equal to the correspondinghigher threshold.
 5. The device of claim 2, wherein the statisticaltests comprise the AIS Monobit Test which provides a sum value T₁, thecorresponding lower threshold L₁ and the higher threshold H₁ being equalto:${L_{1} = {\frac{N}{2} - {\sqrt{\frac{N}{2}} \times {erf}{\;\;}{c^{- 1}(\alpha)}}}},{and}$${H_{1} = {\frac{N}{2} + {\sqrt{\frac{N}{2}} \times {erf}{\;\;}{c^{- 1}(\alpha)}}}},$with α representing the target error probability.
 6. The device of claim2, wherein the statistical tests comprise the AIS Poker Test whichprovide a sum value T₂, the corresponding lower threshold L₂ and thehigher threshold H₂ being equal to:${L_{2} = {\left( {{\chi_{({2^{M} - 1})}^{2}\left( {{0.3} \times \alpha} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}},{and}$${H_{2} = {\left( {{\chi_{({2^{M} - 1})}^{2}\left( {1 - {{0.7} \times \alpha}} \right)} + \left\lfloor \frac{N}{M} \right\rfloor} \right) \times \frac{\left\lfloor \frac{N}{M} \right\rfloor}{2^{M}}}},$with M representing the length of the contiguous blocks in the bitsequence and a representing the error probability.
 7. The device ofclaim 2, wherein the statistical tests comprise the AIS runs Test whichprovides a sum value T_(3(N,k)) for each run of length k, the lowerthreshold L_(3,k) and the higher threshold H_(3,k) for each run oflength k being equal to:L _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α)H _(3,k)=μ_(N,k)−√{square root over (2×μ_(N,k))}×erfc⁻¹(α), with αrepresenting the target error probability and$\mu_{N,k} = {\frac{N}{2^{k + 2}}.}$
 8. The device of claim 1, whereinsaid at least one or more statistical tests applied to the sequencecomprise an additional set of statistical tests, the testing devicedetermining, for each statistical test, a test parameter determined fromN and from the error probability.
 9. The device of claim 8, wherein thestatistical tests comprises the AIS Longest Run Test, the test parameterbeing a run length k, said length k being determined according to thefollowing equation:${k = {- {\log_{2}\left( {1 - e^{\frac{\ln{(\alpha)}}{N}}} \right)}}},$where α designates the long run probability, wherein the comparatorcomparing said test parameter k to the run of maximal length.
 10. Thedevice of claim 1, wherein the bit sequence length N is changed betweenone or more clock cycles.
 11. The device of claim 1, wherein a new valuefor the error probability and the number N may be received at differenttimes or simultaneously.
 12. A system implemented on at least oneintegrated circuits, said system comprising a device using a random bitsequence generated by a random number generator, wherein said devicefurther comprises a testing device according to claim 1 for testing eachrandom bit sequence generated by said random number generator.
 13. Amethod for testing a bit sequence generated by a Random NumberGenerator, wherein the method comprises applying one or more statisticaltests to the bit sequence, in response the detection of N bits generatedby the Random number generator, each statistical test providing at leastone test parameter from the bits of said sequence, the testing methodcomprising: comparing at least one test parameter related to eachstatistical test to one or more thresholds; determining if said bitsequence is valid depending on the comparison performed for eachstatistical test in said comparing step; wherein at least one of saidtest parameter and said at least one threshold is determined from N andfrom a target error probability.